Cramer–Shoup cryptosystem